moparisthebest/xeps
1
0
Fork 0
mirror of https://github.com/moparisthebest/xeps synced 2024-11-25 18:52:23 -05:00
Code Issues Releases Wiki Activity

Adjust to Jingle-XTLS, Jingle-S5B, and Jingle-IBB.

Browse Source 
The basic stream setup from XEP-0246 is now included in the document


git-svn-id: file:///home/ksmith/gitmigration/svn/xmpp/trunk@2760 4b5297f7-1745-476d-ba37-a9c6900126ab
This commit is contained in:
Dirk Meyer 2009-02-20 13:51:51 +00:00
parent 69f94b5bcd
commit 8f924fe372
1 changed files with 165 additions and 120 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

279
xep-0247.xml
View File

@ -26,6 +26,12 @@
&stpeter; &stpeter;
&infiniti; &infiniti;
&dmeyer; &dmeyer;
<revision>
<version>0.2</version>
<date>2009-02-20</date>
<initials>dm</initials>
<remark><p>Adjust to Jingle-XTLS, Jingle-S5B, and Jingle-IBB. The basic stream setup from XEP-0246 is now included in the document</p></remark>
</revision>
<revision> <revision>
<version>0.1</version> <version>0.1</version>
<date>2008-06-18</date> <date>2008-06-18</date>
@ -47,34 +53,37 @@
<li>Two endpoints want to enforce end-to-end encryption</li> <li>Two endpoints want to enforce end-to-end encryption</li>
<li>Two endpoints want to send a high volume of XMPP traffic but the intermediate servers enforce rate limits</li> <li>Two endpoints want to send a high volume of XMPP traffic but the intermediate servers enforce rate limits</li>
</ul> </ul>
<p>The first situation is addressed by &xep0174;. However, if the endpoints already have client-to-server connections but wish to bypass those connections or leverage those streams for a higher-level application such as end-to-end encryption, it is desirable for the two endpoints to negotiate an end-to-end XML stream. This specification defines methods for doing so, where the application format is an XML stream and the transport method is any direct or mediated reliable transport, such as &xep0047; (mediated), &xep0065; (direct or mediated), or a future ice-tcp Jingle transport (direct or mediated) based on &ice-tcp;.</p> <p>The first situation is addressed by &xep0174;. However, if the endpoints already have client-to-server connections but wish to bypass those connections or leverage those streams for a higher-level application such as end-to-end encryption, it is desirable for the two endpoints to negotiate an end-to-end XML stream. This specification defines methods for doing so, where the application format is an XML stream and the transport method is any direct or mediated reliable transport, such as &xep0261; (mediated), &xep0260; (direct or mediated), or a future ice-tcp Jingle transport (direct or mediated) based on &ice-tcp;.</p>
</section1> </section1>
<section1 topic='How It Works' anchor='protocol'> <section1 topic='Open a Secure Stream' anchor='protocol'>
<p>This section provides a friendly introduction to Jingle XML streams.</p> <p>This section provides a friendly introduction to Jingle XML streams.</p>
<p>First, the party that wishes to initiate the stream determines the responder's capabilities (via &xep0030; or &xep0115;). Here we assume that the responder supports a service discovery feature of 'urn:xmpp:tmp:jingle:apps:xmlstream' &NSNOTE; corresponding to the Jingle XML stream functionalited defined herein, as well as the 'urn:xmpp:tmp:jingle:transports:bytestreams' and 'urn:xmpp:tmp:jingle:transports:ibb' features currently defined in &xep0234;.</p> <p>First, the party that wishes to initiate the stream determines the responder's capabilities (via &xep0030; or &xep0115;). Here we assume that the responder supports a service discovery feature of 'urn:xmpp:tmp:jingle:apps:xmlstream:0' &NSNOTE; corresponding to the Jingle XML stream functionalited defined herein, as well as the 'urn:xmpp:jingle:transports:s5b:0' and 'urn:xmpp:jingle:transports:ibb:0' features.</p>
<p>The initiator then sends a Jingle session-initiation request to the responder. The content-type of the request specifies two things:</p> <p>The initiator then sends a Jingle session-initiation request to the responder. The content-type of the request specifies three things:</p>
<ol start='1'> <ol start='1'>
<li><p>An application type of "urn:xmpp:tmp:jingle:apps:xmlstream" &NSNOTE;, where the &lt;description/&gt; element specifies parameters for the XML stream and the parameters map to those provided in &xep0155; in a way that is consistent with &xep0116;.</p></li> <li><p>An application type of "urn:xmpp:tmp:jingle:apps:xmlstream:0" &NSNOTE;, where the &lt;description/&gt; element specifies parameters for the XML stream and the parameters map to those provided in &xep0155; in a way that is consistent with &xep0116;.</p></li>
<li><p>Options for the reliable transport method, such as In-Band Bytestreams ("IBB") as defined in <cite>XEP-0047</cite> or SOCKS5 Bytestreams ("S5B") as defined in <cite>XEP-0065</cite>.</p></li> <li><p>Options for the reliable transport method, such as In-Band Bytestreams ("IBB") as defined in <cite>XEP-0261</cite> or SOCKS5 Bytestreams ("S5B") as defined in <cite>XEP-0260</cite>.</p></li>
<li><p>A security element as defined by <cite>Jingle-XTLS</cite>.</p></li>
</ol> </ol>
<p>In this example, the initiator is &lt;alice@example.org&gt;, the responder is &lt;bob@example.com&gt;, and the initiation request specifies Alice's desired stream parameters along with a transport method of "bytestreams" (i.e., <cite>XEP-0065</cite>).</p> <p>In this example, the initiator is &lt;romeo@montague.lit&gt;, the responder is &lt;juliet@capulet.lit&gt;, and the initiation request specifies Alice's desired stream parameters along with a transport method of "s5b" (i.e., <cite>XEP-0260</cite>).</p>
<p>The flow is as follows.</p> <p>The flow is as follows.</p>
<code><![CDATA[ <code><![CDATA[
Alice Bob Romeo Juliet
| | | |
| session-initiate | | session-initiate |
|---------------------------->| |---------------------------->|
| ack | | ack |
|<----------------------------| |<----------------------------|
| [ SOCKS5 negotiation ] |
|<--------------------------->|
| session-accept | | session-accept |
|<----------------------------| |<----------------------------|
| ack | | ack |
|---------------------------->| |---------------------------->|
| [ SOCKS5 negotiation ] |
|<--------------------------->|
| [ TLS handshake ] |
|<--------------------------->|
| [ XML stream ] | | [ XML stream ] |
|---------------------------->| |<--------------------------->|
| terminate | | terminate |
|<----------------------------| |<----------------------------|
| ack | | ack |
@ -83,55 +92,88 @@
]]></code> ]]></code>
<p>First the initiator sends a Jingle session-initiate.</p> <p>First the initiator sends a Jingle session-initiate.</p>
<example caption="Initiator sends session-initiate"><![CDATA[ <example caption="Initiator sends session-initiate"><![CDATA[
<iq from='alice@example.org/foo' <iq from='romeo@montague.lit/orchard'
id='jingle1' id='jingle1'
to='bob@example.com/bar' to='juliet@capulet.lit/balcony'
type='set'> type='set'>
<jingle xmlns='urn:xmpp:tmp:jingle' <jingle xmlns='urn:xmpp:jingle:0'
action='session-initiate' action='session-initiate'
initiator='alice@example.org/foo' initiator='romeo@montague.lit/orchard'
sid='851ba2'> sid='851ba2'>
<content creator='initiator' name='xmlstream'> <content creator='initiator' name='xmlstream'>
<description <description xmlns='urn:xmpp:tmp:jingle:apps:xmlstream:0'/>
xmlns='urn:xmpp:tmp:jingle:apps:xmlstream' <transport xmlns='urn:xmpp:jingle:transports:s5b:0'
authentication='optional' sid='vj3hs98y'
disclosure='never' mode='tcp'>
logging='mustnot' <streamhost
tls='required'/> jid='romeo@montague.lit/orchard'
<transport xmlns='urn:xmpp:tmp:jingle:transports:bytestreams'/> host='192.168.4.1'
port='5086'/>
<streamhost
jid='streamer.shakespeare.lit'
host='24.24.24.1'
zeroconf='_jabber.bytestreams'/>
</transport>
</content> </content>
</jingle> </jingle>
</iq> </iq>
]]></example> ]]></example>
<p>The responder immediately acknowledges receipt of the Jingle session-initiate.</p> <p>The responder immediately acknowledges receipt of the Jingle session-initiate.</p>
<example caption="Responder acknowledges session-initiate"><![CDATA[ <example caption="Responder acknowledges session-initiate"><![CDATA[
<iq from='bob@example.com/bar' <iq from='juliet@capulet.lit/balcony'
id='jingle1' id='jingle1'
to='alice@example.org/foo' to='romeo@montague.lit/orchard'
type='result'/> type='result'/>
]]></example> ]]></example>
<p>The initiator then attempts to initiate a SOCKS5 Bytestream with the responder.</p> <p>If the user accepts the session the responder sends a session-accept.</p>
<example caption='Initiation of Interaction'><![CDATA[ <example caption="Responder sends session-accept with streamhost candidates"><![CDATA[
<iq type='set' <iq from='juliet@capulet.lit/balcony'
from='alice@example.org/foo' id='hwd987h'
to='bob@example.com/bar' to='romeo@montague.lit/orchard'
id='initiate'> type='set'>
<query xmlns='http://jabber.org/protocol/bytestreams' <jingle xmlns='urn:xmpp:jingle:0'>
sid='mySID' action='session-accept'
initiator='romeo@montague.lit/orchard'
sid='a73sjjvkla37jfea'>
<content creator='initiator' name='stub'>
<description xmlns='urn:xmpp:jingle:apps:stub:0'/>
<transport xmlns='urn:xmpp:jingle:transports:s5b:0'
sid='vj3hs98y'
mode='tcp'> mode='tcp'>
<streamhost <streamhost
jid='alice@example.org/foo' jid='juliet@capulet.lit/balcony'
host='192.168.4.1' host='192.169.1.10'
port='5086'/> port='6539'/>
<streamhost <streamhost
jid='streamhostproxy.example.net' jid='juliet@capulet.lit/balcony'
host='24.24.24.1' host='134.102.201.180'
zeroconf='_jabber.bytestreams'/> port='16453'/>
</query> <streamhost
jid='juliet@capulet.lit/balcony'
host='2001:638:708:30c9:219:d1ff:fea4:a17d'
port='6539'/>
</transport>
<security xmlns='urn:xmpp:jingle:security:xtls:0'/>
<offer xmlns='urn:xmpp:tmp:c2ctls'>
<keyinfo xmlns='urn:xmpp:tmp:pubkey'>
<name>JulietX509CertificateHash</name>
</keyinfo>
<srp/>
</offer>
</security>
</content>
</jingle>
</iq> </iq>
]]></example> ]]></example>
<p>If the responder is willing to accept the bytestream, it MUST attempt to open a standard TCP socket on the network address of the StreamHost communicated by the initiator. If the initiator provides more than one StreamHost, the responder SHOULD try to connect to them in the order they occur.</p> <p>The initiator acknowledges receipt and tries to connect to the offered StreamHosts.</p>
<p>If the responder is able to open a TCP socket on a StreamHost, it MUST utilize the SOCKS5 protocol specified in &rfc1928; to establish the connection with the StreamHost.</p> <example caption="Initiator acknowledges session-accept"><![CDATA[
<iq from='romeo@montague.lit/orchard'
id='hwd987h'
to='juliet@capulet.lit/balcony'
type='result'/>
]]></example>
<p>The clients MUST attempt to open a standard TCP socket on the network address of the StreamHost communicated by the peer. If more than one StreamHost was provided, the client SHOULD try to connect to them in the order they occur.</p>
<p>If the client is able to open a TCP socket on a StreamHost, it MUST utilize the SOCKS5 protocol specified in &rfc1928; to establish the connection with the StreamHost.</p>
<example caption='Responder Connects to StreamHost'><![CDATA[ <example caption='Responder Connects to StreamHost'><![CDATA[
CMD = X'01' CMD = X'01'
ATYP = X'03' ATYP = X'03'
@ -141,47 +183,88 @@ DST.PORT = 0
<example caption='StreamHost Acknowledges Connection'><![CDATA[ <example caption='StreamHost Acknowledges Connection'><![CDATA[
STATUS = X'00' STATUS = X'00'
]]></example> ]]></example>
<p>After the responder has authenticated with the StreamHost, it MUST send an IQ-result to the initiator indicating which StreamHost was used.</p> <p>After one client has authenticated with the StreamHost, it MUST send a Jingle transport-info to the initiator indicating which StreamHost was used.</p>
<example caption='Responder Notifies Initiator of Connection'><![CDATA[ <example caption="Initiator sends streamhost-used in Jingle transport-info"><![CDATA[
<iq type='result' <iq from='romeo@montague.lit/orchard'
from='bob@example.com/bar' id='hjdi8'
to='alice@example.org/foo' to='juliet@capulet.lit/balcony'
id='initiate'>
<query xmlns='http://jabber.org/protocol/bytestreams'>
<streamhost-used jid='streamhostproxy.example.net'/>
</query>
</iq>
]]></example>
<p>The responder then sends a Jingle session-accept.</p>
<example caption="Responder sends session-accept"><![CDATA[
<iq from='bob@example.com/bar'
id='accept1'
to='alice@example.org/foo'
type='set'> type='set'>
<jingle xmlns='urn:xmpp:tmp:jingle' <jingle xmlns='urn:xmpp:jingle:0'>
action='session-accept' action='transport-info'
initiator='alice@example.org/foo' initiator='romeo@montague.lit/orchard'
sid='851ba2'> sid='a73sjjvkla37jfea'>
<content creator='initiator' name='xmlstream'> <content creator='initiator' name='stub'>
<description <transport xmlns='urn:xmpp:jingle:transports:s5b:0'
xmlns='urn:xmpp:tmp:jingle:apps:xmlstream' sid='vj3hs98y'
authentication='optional' mode='tcp'>
disclosure='never' <streamhost-used
logging='mustnot' jid='juliet@capulet.lit/balcony'
tls='required'/> host='134.102.201.180'
<transport xmlns='urn:xmpp:tmp:jingle:transports:bytestreams'/> port='16453'/>
</transport>
</content> </content>
</jingle> </jingle>
</iq> </iq>
]]></example> ]]></example>
<p>The initiator acknowledges the Jingle session-accept.</p> <p>The peer immediately acknowledges receipt.</p>
<example caption="Initiator acknowledges session-accept"><![CDATA[ <example caption="Responder acknowledges streamhost-used message"><![CDATA[
<iq from='bob@example.com/bar' <iq from='juliet@capulet.lit/balcony'
id='accept1' id='hjdi8'
to='alice@example.org/foo' to='romeo@montague.lit/orchard'
type='result'/> type='result'/>
]]></example> ]]></example>
<p>Now the parties start an XML stream over the negotiated bytestream, following the recommendations in &xep0246;.</p> <p>Parallel to the SOCKS5 transport setup the initiator signals the TLS method to be used to the responder.</p>
<example caption="Initiator sends security-info"><![CDATA[
<iq from='romeo@montague.lit/orchard'
id='hf749j'
to='juliet@capulet.lit/balcony'
type='set'>
<jingle xmlns='urn:xmpp:jingle:0'>
action='security-info'
initiator='romeo@montague.lit/orchard'
sid='a73sjjvkla37jfea'>
<content creator='initiator' name='xmlstream'>
<security xmlns='urn:xmpp:jingle:security:xtls:0'
method='x509'/>
</content>
</jingle>
</iq>
]]></example>
<p>The responder acknowledges the receipt</p>
<example caption='Responder acknowledges security-info'><![CDATA[
<iq from='juliet@capulet.lit/balcony'
id='hf749j'
to='romeo@montague.lit/orchard'
type='result'/>
]]></example>
<p>After the transport stream is ready and the initiator received the acknowledment from the security-info it starts the four-way TLS handshake on the transport stream.</p>
</section1>
<section1 topic='Initiating an e2e Stream' anchor='initiate'>
<p>If the TLS handshake is complete both clients send an initial &lt;stream/&gt; element to open a client-to-client stream</p>
<example caption="Opening a Stream"><![CDATA[
<stream:stream
xmlns='jabber:client'
xmlns:stream='http://etherx.jabber.org/streams'
from='romeo@montague.lit/orchard'
to='juliet@capulet.lit/balcony'
version='1.0'>
]]></example>
<p>In accordance with &rfc3921bis;, the initial stream header SHOULD include the 'to' and 'from' attributes. This should be the full JID of the clients. If the initiator supports stream features and the other stream-related aspects of XMPP 1.0 as specified in <cite>RFC 3920</cite>, then it SHOULD include the version='1.0' flag as shown in the previous example.</p>
</section1>
<section1 topic='Exchanging Stanzas' anchor='exchange'>
<p>Once the streams are established, either entity then can send XMPP message, presence, and IQ stanzas, with or without 'to' and 'from' addresses.</p>
<example caption="Sending a Message"><![CDATA[
<message from='romeo@montague.lit/orchard' to='juliet@capulet.lit/balcony'>
<body>M'lady, I would be pleased to make your acquaintance.</body>
</message>
]]></example>
<example caption="A Reply"><![CDATA[
<message from='juliet@capulet.lit/balcony' to='romeo@montague.lit/orchard'>
<body>Art thou not Romeo, and a Montague?</body>
</message>
]]></example>
</section1> </section1>
<section1 topic='Implementation Notes' anchor='impl'> <section1 topic='Implementation Notes' anchor='impl'>
@ -193,17 +276,13 @@ STATUS = X'00'
</section2> </section2>
</section1> </section1>
<section1 topic='Security Considerations' anchor='security'>
<p>In order to secure the e2e XML stream, implementations SHOULD use the standard STARTTLS method defined in <cite>XMPP Core</cite> but MAY instead use a TLS encrypted port that provides immediate encryption rather than upgrading of the stream via STARTTLS.</p>
</section1>
<section1 topic='IANA Considerations' anchor='iana'> <section1 topic='IANA Considerations' anchor='iana'>
<p>No interaction with &IANA; is required as a result of this document.</p> <p>No interaction with &IANA; is required as a result of this document.</p>
</section1> </section1>
<section1 topic='XMPP Registrar Considerations' anchor='registrar'> <section1 topic='XMPP Registrar Considerations' anchor='registrar'>
<section2 topic='Protocol Namespaces' anchor='ns'> <section2 topic='Protocol Namespaces' anchor='ns'>
<p>Until this specification advances to a status of Draft, its associated namespaces shall be 'urn:xmpp:tmp:jingle:apps:xmlstream'. Upon advancement of this specification, the &REGISTRAR; shall issue a permanent namespace in accordance with the process defined in Section 4 of &xep0053;. The namespace 'urn:xmpp:jingle:apps:xmlstream' is requested and is thought to be unique per the XMPP Registrar's requirements.</p> <p>Until this specification advances to a status of Draft, its associated namespaces shall be 'urn:xmpp:tmp:jingle:apps:xmlstream:0'. Upon advancement of this specification, the &REGISTRAR; shall issue a permanent namespace in accordance with the process defined in Section 4 of &xep0053;. The namespace 'urn:xmpp:jingle:apps:xmlstream' is requested and is thought to be unique per the XMPP Registrar's requirements.</p>
</section2> </section2>
<section2 topic='Jingle Application Formats' anchor='registrar-content'> <section2 topic='Jingle Application Formats' anchor='registrar-content'>
<p>The XMPP Registrar shall include "xmlstream" in its registry of Jingle application formats. The registry submission is as follows:</p> <p>The XMPP Registrar shall include "xmlstream" in its registry of Jingle application formats. The registry submission is as follows:</p>
@ -224,48 +303,14 @@ STATUS = X'00'
<xs:schema <xs:schema
xmlns:xs='http://www.w3.org/2001/XMLSchema' xmlns:xs='http://www.w3.org/2001/XMLSchema'
targetNamespace='urn:xmpp:tmp:jingle:apps:xmlstream' targetNamespace='urn:xmpp:tmp:jingle:apps:xmlstream:0'
xmlns='urn:xmpp:tmp:jingle:apps:xmlstream' xmlns='urn:xmpp:tmp:jingle:apps:xmlstream:0'
elementFormDefault='qualified'> elementFormDefault='qualified'>
<xs:element name='description'> <xs:element name='description'>
<xs:complexType> <xs:complexType>
<xs:simpleContent> <xs:simpleContent>
<xs:extension base='empty'> <xs:extension base='empty'/>
<xs:attribute name='authentication' use='required'>
<xs:simpleType>
<xs:restriction base='xs:NCName'>
<xs:enumeration value='optional'/>
<xs:enumeration value='required'/>
</xs:restriction>
</xs:simpleType>
</xs:attribute>
<xs:attribute name='disclosure' use='required'>
<xs:simpleType>
<xs:restriction base='xs:NCName'>
<xs:enumeration value='disabled'/>
<xs:enumeration value='enabled'/>
<xs:enumeration value='never'/>
</xs:restriction>
</xs:simpleType>
</xs:attribute>
<xs:attribute name='logging' use='required'>
<xs:simpleType>
<xs:restriction base='xs:NCName'>
<xs:enumeration value='may'/>
<xs:enumeration value='mustnot'/>
</xs:restriction>
</xs:simpleType>
</xs:attribute>
<xs:attribute name='tls' use='required'>
<xs:simpleType>
<xs:restriction base='xs:NCName'>
<xs:enumeration value='optional'/>
<xs:enumeration value='required'/>
</xs:restriction>
</xs:simpleType>
</xs:attribute>
</xs:extension>
</xs:simpleContent> </xs:simpleContent>
</xs:complexType> </xs:complexType>
</xs:element> </xs:element>